Remove only from wp-packages config

[tangrufus]

See roots/wp-packages#43

[Copilot]

Pull request overview

This PR updates the Composer repository configuration for wp-packages by removing the package allowlist, and regenerates the lockfile hash to reflect the config change.

Changes:

• Remove the only allowlist from the wp-packages Composer repository entry.
• Update composer.lock content hash to match the modified composer.json.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
composer.json	Removes only from the wp-packages repository configuration.
composer.lock	Updates the lockfile content-hash to reflect the composer.json change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Removing the only whitelist means this repository can now advertise any package names, and Composer may prefer packages from repo.wp-packages.org over Packagist when a name exists in both repos. To avoid accidental/supply-chain shadowing of non-WordPress dependencies, consider setting this repository to canonical: false (or reintroduce a narrower allowlist/exclude list) while still allowing wp-plugin/* and wp-theme/* packages to resolve from it.

Suggested change

	"url": "https://repo.wp-packages.org"
	"url": "https://repo.wp-packages.org",
	"canonical": false